Just FYI, the recent "taint fix" commit has zero effect on tainting, positive or negative. The loop variables in a 'for' statement are inherently local to the loop. Declaring them before the loop only makes them visible past the loop's end. It increases visibility, not decreases it.